You're allowed to break your own copy. Other people are allowed to keep their copies in working order.
This is a reminder of how much power you cede to Microsoft when you decide to make yourself completely reliant on their free services.
If you mount a supply-chain attack, deliberately overwriting a package you know people are relying on with code that will break their systems, that is something else.
Maybe GitHub should have frozen only this one repo, though I doubt that would have made a difference in the public response. But you can't really say that they banned someone's private little experiment here.
As to the power you cede to Microsoft, that is a weird way to phrase it. Microsoft gave you the right to use their platform, for free. All they did is take that away. That is not much power at all.
GitHub Actions uses tags to represent it's versions, which would be great if GitHub locked down tags. They don't. Every GitHub Action I encountered in my first foray into the technology a couple weeks ago included a "Publish" script - that as it's first action, deleted a tag! And then reused that tag.
This is absolutely a supply chain attack, if not a malicious one.
It seems like access was restored pretty quickly because within hours of the whole thing going down and reading about him being banned, I could see it was already restored.
Anyway, if my account started to sabotage my projects, I’d hope GitHub would suspend it until there was a better understanding of what was going on.